ClawHub
Back to skill

Security audit

Sonos控制工具-免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a Sonos control guide, but its broad trigger wording and local-network device control deserve user review before installation.

Install only if you intend to let an agent control Sonos devices on networks you own or administer. Before running discovery or playback commands, confirm the target network and room/device, and avoid using the skill for generic automation tasks unless the request explicitly involves Sonos or speaker control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger condition is framed so broadly ('提升效率、自动化流程、批量处理、工作流优化时使用') that an agent could invoke this skill for many unrelated tasks, despite the skill being capable of local-network discovery and device control. In context, that increases the chance of unintended Sonos commands or LAN interaction without clear user intent, which is a real safety issue even if it does not by itself create code execution.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents commands for discovering devices on the local network and controlling them, but does not provide a prominent warning or consent requirement before LAN scanning and device interaction. In an agent context with exec/read/write access, this can lead to unauthorized network probing or control of nearby Sonos devices, especially in shared home or office environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.